chore(deps): update dependency @tanstack/react-query (5.102.3 → 5.104.0) #1133

Workflow file for this run

	name: CI

	on:
	push:
	# `renovate/**` is here because Renovate is configured for branch-based
	# automerge (`:automergeBranch` in renovate.json5): it pushes the update to
	# a branch and fast-forwards main once that branch's checks pass, WITHOUT
	# ever opening a pull request. A push to such a branch matches neither
	# `branches: [main]` nor `pull_request`, so before this entry those
	# branches carried zero check runs — the only status on them was Renovate's
	# own `renovate/stability-days` soak timer. That made the "CI is the gate"
	# premise documented in renovate.json5 vacuous: an update could reach main
	# having been verified by nothing but the 3-day wait.
	branches: [main, "renovate/**"]
	pull_request:

	# Least privilege: CI only needs to read the repo.
	permissions:
	contents: read

	# Cancel superseded runs on the same ref to save CI minutes.
	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# --- Action pinning policy -------------------------------------------------
	# The toolchain (Rust, Node, pnpm) is installed by mise from the pinned
	# versions in .mise/config.toml + .mise/mise.lock, via `jdx/mise-action`, which
	# is pinned to a full commit SHA. The remaining third-party actions use
	# major-version tags for readability; for a hardened setup, pin each to a full
	# commit SHA (e.g. `actions/checkout@b4ffde6... # v4.2.2`) and let
	# Renovate/Dependabot bump them. The `# vX` comments mark the intended pin.
	# ---------------------------------------------------------------------------

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	jobs:
	fmt:
	name: rustfmt
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	# Every gate below is a mise task, so `mise run <task>` locally runs the
	# exact same command as CI (`mise run ci` runs the whole matrix).
	- run: mise run fmt-check

	clippy:
	name: clippy
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	- run: mise run clippy

	test:
	name: test
	runs-on: ubuntu-24.04
	# The suite runs in seconds; anything approaching this is a hang. Bounded
	# for the same reason as the `web` job below, and more sharply needed here:
	# these tests spawn subprocesses and bind sockets, and a stub waiting on a
	# request that never arrives blocks until its own deadline with no output.
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	with:
	key: test
	- run: mise run test

	test-pg:
	name: test-pg
	runs-on: ubuntu-24.04
	# Same suite as `test`, against the Postgres backend. The runner's Docker
	# hosts the database; a per-test CREATE DATABASE keeps tests isolated.
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	with:
	key: test-pg
	- run: mise run test-pg

	saml:
	name: saml (feature-gated tests)
	runs-on: ubuntu-24.04
	# rust:bookworm brings its own toolchain + the apt packages samael's
	# xmlsec backend needs at build time; mise is not used here.
	container: rust:1-bookworm
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- name: Install xmlsec build dependencies
	run: \|
	apt-get update
	apt-get install -y --no-install-recommends \
	libxmlsec1-dev libxml2-dev libxslt1-dev libssl-dev libltdl-dev \
	pkg-config clang
	# The rust:bookworm image ships rustc/cargo but not the clippy
	# component; the other CI jobs get it via mise-action.
	- run: rustup component add clippy
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	with:
	key: saml
	- run: cargo clippy -p domarinn-server --features saml --all-targets -- -D warnings
	- run: cargo test -p domarinn-server --features saml

	commit-messages:
	name: commit messages parse for release-please
	# A message release-please cannot parse is SKIPPED by it rather than
	# reported, so the work it carries never reaches a changelog — and when it
	# is the only commit since the last release, no release pull request is
	# created at all. This is the gate; the lefthook commit-msg hook is the
	# same checker run earlier, and skips when node deps are absent.
	# Also runs on Renovate's automerge branches: those fast-forward onto main
	# without ever being a pull request, so this is the only point at which
	# their messages can be checked. Skipped on push to main itself — by then
	# the commit has landed and there is nothing left to gate.
	if: github.event_name == 'pull_request' \|\| startsWith(github.ref, 'refs/heads/renovate/')
	runs-on: ubuntu-24.04
	timeout-minutes: 5
	env:
	MISE_DISABLE_TOOLS: rust
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	# Every commit in the pull request, not just the tip.
	fetch-depth: 0
	- uses: ./.github/actions/setup-web
	# Guard on the guard: if the checker itself is wrong, the messages it
	# blesses mean nothing.
	# Both invocation paths on purpose: the first failure of this job was the
	# pnpm wrapper forwarding a bare `--` as the filename, not the checker.
	- name: Self-test the checker
	run: \|
	node web/scripts/check-commit-msg.mjs --self-test
	pnpm -C web run check-commit-msg -- --self-test
	- name: Check every commit in this change
	env:
	# Both are empty on a push event — there is no pull_request payload.
	BASE: ${{ github.event.pull_request.base.sha }}
	HEAD: ${{ github.event.pull_request.head.sha }}
	run: \|
	set -euo pipefail
	if [ -z "${BASE:-}" ]; then
	# Renovate automerge branch: derive the range from main instead.
	# `origin/main` is present because checkout above uses
	# fetch-depth: 0, which fetches every branch. If it is somehow
	# missing this fails loudly rather than checking an empty range —
	# a gate that silently passes is worse than no gate.
	BASE="$(git merge-base origin/main HEAD)"
	HEAD="$(git rev-parse HEAD)"
	fi
	failed=0
	msg="$(mktemp)"
	for sha in $(git rev-list "$BASE..$HEAD"); do
	git log -1 --format=%B "$sha" > "$msg"
	if ! node web/scripts/check-commit-msg.mjs "$msg"; then
	echo "::error::commit $sha has a message release-please cannot parse"
	failed=1
	fi
	done
	exit "$failed"

	web-lint:
	name: web lint
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	env:
	# `mise run` auto-installs every tool in .mise/config.toml, which would
	# pull in the Rust toolchain this job never uses — skip it.
	MISE_DISABLE_TOOLS: rust
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: ./.github/actions/setup-web
	# Type-checked lint (--max-warnings=0).
	- run: mise run web-lint

	web-build:
	name: web build (typecheck)
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	env:
	MISE_DISABLE_TOOLS: rust
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: ./.github/actions/setup-web
	# This IS the typecheck gate: the task runs `tsc -b` before vite, so any
	# type error fails here rather than in a separate step.
	- run: mise run web-build

	web-test:
	name: web unit tests (vitest)
	runs-on: ubuntu-24.04
	# The suite takes seconds; anything approaching this is a hang, not
	# slowness. Without a bound a wedged run burned ~14 minutes and still
	# produced no logs, which is the worst of both — slow and undiagnosable.
	timeout-minutes: 10
	env:
	MISE_DISABLE_TOOLS: rust
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: ./.github/actions/setup-web
	- run: mise run web-test

	e2e:
	name: web e2e (playwright)
	runs-on: ubuntu-24.04
	# The suite itself is fast; the budget is dominated by the chromium
	# download. Bounded for the same reason as the `web` job — a wedged
	# browser launch produces no logs, so it must fail rather than hang.
	timeout-minutes: 15
	env:
	# Playwright drives a mock build (`VITE_MOCK=1`), served by the config's
	# own `webServer`. No Rust backend is involved, so skip that toolchain.
	MISE_DISABLE_TOOLS: rust
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: ./.github/actions/setup-web
	# Only chromium: playwright.config.ts declares a single chromium project.
	# `--with-deps` pulls the system shared libraries the CDN build needs.
	- name: Install Playwright chromium
	run: pnpm -C web exec playwright install --with-deps chromium
	- run: mise run e2e
	# The HTML report is the only way to diagnose a failure after the fact —
	# the trace/screenshot artifacts are worthless if they stay on the runner.
	- if: failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 # pin to SHA
	with:
	name: playwright-report
	path: web/playwright-report/
	retention-days: 7

	schema-check:
	name: schema is up to date
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	# Regenerates the schema and diffs it against the committed copy; the
	# full logic lives in the `schema-check` task (.mise/config.toml) so the
	# local run and CI can never drift apart.
	- name: Fail on schema drift
	run: mise run schema-check

	gen-types-check:
	name: generated TS types are up to date
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	# Regenerates the TypeScript DTOs and fails on any drift (including
	# untracked new files); the full logic lives in the `gen-types-check`
	# task (.mise/config.toml) so the local run and CI can never drift apart.
	- name: Fail on generated-type drift
	run: mise run gen-types-check

	workflow-lint:
	name: workflows pass zizmor
	runs-on: ubuntu-24.04
	# .lefthook.toml runs zizmor on staged workflow files pre-commit, but a
	# fork PR never runs our hooks — on a public repo this job is the only
	# thing standing between a malicious workflow edit and a merge.
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: zizmor
	- run: mise run workflow-lint

	musl-build:
	name: static musl build (${{ matrix.target }})
	runs-on: ${{ matrix.runner }}
	strategy:
	fail-fast: false
	matrix:
	# Both shipped targets build natively on a GitHub-hosted runner, so CI
	# proves the static link for each one release.yml will publish. No
	# cross-compilation and no QEMU: the aarch64 leg is a real arm64 host.
	include:
	- target: x86_64-unknown-linux-musl
	runner: ubuntu-24.04
	- target: aarch64-unknown-linux-musl
	runner: ubuntu-24.04-arm
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # pin to SHA
	with:
	persist-credentials: false
	- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
	with:
	install_args: rust
	- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # pin to SHA
	with:
	key: ${{ matrix.target }}

	# musl-tools gives the C toolchain rusqlite's bundled SQLite (and the
	# rustls crypto backend) need; cmake is a hedge for crypto backends.
	- name: Install musl toolchain
	run: \|
	sudo apt-get update
	sudo apt-get install -y --no-install-recommends musl-tools cmake

	# The `musl-build` task adds the rustup target itself (mise's rust
	# delegates to rustup) and then builds; same command locally and in CI.
	# MUSL_TARGET defaults to the x86_64 triple, so a bare `mise run
	# musl-build` on a dev machine keeps working unchanged.
	- name: Build
	env:
	MUSL_TARGET: ${{ matrix.target }}
	run: mise run musl-build

	- name: Confirm the binary is static
	run: file target/${{ matrix.target }}/release/domarinn \|\| true

Navigation Menu

chore(deps): update dependency @tanstack/react-query (5.102.3 → 5.104.0) #1133

Workflow file

chore(deps): update dependency @tanstack/react-query (5.102.3 → 5.104.0) #1133

Uh oh!

Workflow file for this run